Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Monthly Threat Intelligence

Cyware Monthly Threat Intelligence - Featured Image

Monthly Threat Briefing Jun 1, 2020

The Good

The entire world is in the middle of a pandemic and people are mostly working from their homes. Organizations around the globe are devising security measures against cyber threats to protect their virtual workspaces. For instance, last month, Google launched the ‘Scam Spotter’ program to help individuals tackle COVID-19 related scams whereas, Microsoft open-sourced its Coronavirus threat intel data for security researchers. Moreover, the Cybersecurity and Infrastructure Security Agency (CISA) has updated defensive measures in the wake of heightened attacks on healthcare organizations.

  • Google, in association with the Cybercrime Support Network, launched a new ‘Scam Spotter’ program to help individuals spot and prevent COVID-19 related scams.

  • The CISA improved defence measures for healthcare organizations and research facilities in an effort to protect Coronavirus-related research. The development comes as state-sponsored hackers continue to target Coronavirus-related medical research data.

  • Germany-based Tutanota, a secure email service, is working with the L3S Research Institute of Leibniz University on a new project called PQmail. This project aims to keep email secure by using post-quantum cryptography for encryption.

  • FIRST released an updated version of ‘The Guidelines for Multi-Party Vulnerability Coordination and Disclosure.’ The purpose of the guidelines is to improve coordination and communication across different stakeholders during a vulnerability disclosure.

  • Microsoft open-sourced its threat intel collection to help the security community build protective solutions for users. The initiative was taken following the increase in Coronavirus-related cyber threats.

The Bad

Disarray caused by the pandemic has become a breeding ground for financially-motivated attacks, as implied by the Verizon 2020 Data Breach Investigations Report (DBIR). In one of the cases, hackers siphoned off data from different e-commerce sites and demanded $525 in Bitcoin for not disclosing it in public. Similarly, a group attacked Grubman Shire Meiselas & Sacks and held over 700 GB of its data to ransom. Meanwhile, Maze actors released the credit card details of the Bank of Costa Rica customers for not paying the ransom.

  • Covve leaked 23 million email addresses and other personal details due to an unprotected Elasticsearch database. In total, the database contained 90GB of personal information.

  • Around 31 SQL databases associated with several e-commerce sites were offered for sale on a public website. These databases contained 1.6 million rows of user information. Hackers demanded a ransom of $525 in Bitcoin, asking victims to recover their databases.

  • A cybercriminal group stole around 756 GB of documents and correspondence belonging to high-profile personalities from Grubman Shire Meiselas & Sacks. Later, it claimed to auction the sensitive documents of the international singer, Madonna and the U.S. President.

  • A threat actor leaked a trove of personal and electoral data belonging to 2.3 million Indonesian citizens. The data appeared to be stolen from the official website of the General Elections Commission of Indonesia.

  • NTT disclosed a data breach that resulted in the compromise of data of about 600 customers. The hackers infiltrated the Active Directory services on May 7 to gain access to NTT’s sensitive data.

  • Maze ransomware attacked the financial technology firm, Pitney Bowes. Though the company partially prevented the attack by avoiding file encryption, some of the firm’s data were stolen in the attack.

  • Maze ransomware operators published credit card details of the Bank of Costa Rica (BCR) after a failed ransom demand. The hackers had exfiltrated the data in August 2019.

  • More than 2,000 Israeli websites were defaced to show an anti-Israeli message. Attributed to a hacker group called ‘Hackers of Savior,’ the attacks were executed by exploiting a vulnerability in a WordPress plugin.

  • CAM4 exposed over 4TB of Personally Identifiable Information (PII) of users via a misconfigured database over an unprotected server. The exposed PII included names, private conversations, and IP addresses of the users.

  • Hackers sold records of 22 million Unacademy users after gaining access to their database. The database was put for sale at a price of $2000.

  • Details of 44 million Pakistani mobile users were leaked online this week. The records included customers’ full names, home addresses, phone numbers, and National Identification Numbers.

New Threats

Greater threats surfaced last month due to rickety software and sophisticated malware capabilities. Security researchers discovered a new RangeAmp attack that could bring down websites and Content Delivery Networks (CDNs). Ako ransomware operators added a new tactic to extort more money from victims. Researchers also uncovered the new variants of many malware, including Astaroth, Zeus Sphinx, Dark Crystal RAT, and Anubis Trojan.

  • Two high-severity vulnerabilities found in the PageLayer plugin could let attackers wipe out the content and take control of WordPress sites. The plugin is installed on at least 120,000 sites.

  • A new form of DoS attack called RangeAmp can bring down websites and CDNs by amplifying web traffic. So far, there are two variants of the attack - RangeAmp Small Byte Range (SBR) and RangeAmp Overlapping Byte Ranges (OBR).

  • Ako ransomware operators evolved to add a new tactic in addition to the existing ‘naming and shaming’ strategy to force victim organizations into making extra ransom payments. The extra amount is for deleting the files from firms.

  • The capabilities of Grandoreiro trojan and Valak malware were enhanced to target Portuguese users and Microsoft Exchange servers, respectively. While the former was used to steal banking credentials, the later stole targeted enterprises’ credentials.

  • Netwalker ransomware evolved to include a reflective Dynamic-link Library (DLL) injection as one of its evasion techniques. The technique allows the injection of a DLL from memory rather than from the disk.

  • Academics from Germany and Italy found a new method to break the separation between Wi-Fi and Bluetooth technologies. The attack relies on a new class of vulnerability, named Spectra.

  • All computers manufactured before 2019 are affected by seven vulnerabilities found in Intel’s Thunderbolt hardware interface. Collectively known as Thunderspy, the flaws can allow attackers to gain physical access to devices and steal data from their hard drives.

  • Winnti hacker group targeted video game companies with a new PipeMon backdoor to achieve persistence. PipeMon’s first stage consists of a password-protected RARSFX executable embedded in the .rsrc section of its launcher.

  • Variants of malware such as Astaroth, Zeus Sphinx, Dark Crystal RAT, and Anubis Trojan were uncovered by researchers last month. While the new samples of Astaroth, Dark Crystal RAT, and Zeus Sphinx had anti-analysis techniques added to their modules, the new variant of Anubis, still under development, could allow attackers to gain granular insight into an infected device.

  • An attack campaign, dubbed Blue Mockingbird, was found exploiting a deserialization vulnerability (CVE-2019-18935) in the ASP.NET open-source web framework to deploy the XMRig Monero-mining payload on Windows systems. The campaign, which started in December 2019, lasted till April 2020.

  • A new variant of the SLocker Android malware infected user devices by disguising as ‘About Coronavirus’ app. In addition to this, threat actors updated the evasion capabilities of the EVILNUM Trojan that targeted the financial sector.

Related Threat Briefings

Feb 10, 2025

Cyware Monthly Threat Intelligence, January 2025

The U.K took a proactive stance on cyber resilience with its Cyber Local initiative, injecting £1.9 million into 30 projects across England and Northern Ireland. The effort focuses on closing the cyber skills gap, fortifying small businesses, and supporting underrepresented groups. India tightened its grip on data privacy with new draft rules designed to give citizens more control over their personal information. The proposed regulations mandate clearer data processing disclosures, stricter security protocols, and swift breach reporting. Hackers turned to SparkRAT, an open-source GoLang RAT, to target macOS users and government entities. Initially released in 2022, its modular design and cross-platform capability have made it a cybercriminal favorite. More than 10,000 WordPress sites were hijacked in a large-scale malware campaign delivering AMOS to macOS users and SocGholish to Windows users. Attackers exploited outdated plugins to inject fake browser update prompts. Lumma Stealer is made its way through GitHub in a new malware campaign that abuses the platform’s release infrastructure. Attackers deployed malware like SectopRAT and Vidar, using secure-looking download links to exfiltrate data while evading detection. Cybercriminals deployed the Coyote banking trojan against financial firms in Brazil, using malicious Windows LNK files to execute PowerShell scripts. This malware established secure connections with C2 servers, enabling keylogging and data theft. A two-year-long phishing campaign targeted Microsoft’s advertising platform users through malicious Google Search ads. A Mirai-based botnet exploited zero-day vulnerabilities in industrial routers and smart home devices. With 15,000 active nodes daily, it launched high-intensity DDoS attacks surpassing 100 Gbps, posing a growing threat across multiple countries.

Jan 3, 2025

Cyware Monthly Threat Intelligence, December 2024

The cloud revolution isn’t just about convenience anymore; it’s now the frontline of defense. With CISA's new directive mandating cloud environment fortification, federal agencies face a race against time to safeguard Microsoft 365 and other services. Meanwhile, proposed updates to the HIPAA security rules push healthcare organizations toward stronger PHI protection with advanced technical controls and detailed incident planning. On the global front, Operation PowerOFF turned the tables on DDoS attackers, dismantling 27 illegal platforms and curbing festive-season chaos. The cyber battlefield sees no intermission as new threats take center stage. A phishing campaign, dubbed Aggressive Inventory Zombies (AIZ), exploited brand trust by mimicking retail giants and crypto platforms. Meanwhile, the resurrected BADBOX botnet has compromised 192,000 Android devices globally, sneaking into supply chains to wreak havoc with ad fraud and account abuse. Adding to the turbulence, Poison Ivy (APT-C-01) resurged, targeting critical sectors with advanced phishing techniques and deploying Sliver RAT to breach systems and steal sensitive data. This month, new threats targeted IoT, banking, and app ecosystems, with threat actors unleashing diverse attacks. Iranian hackers deployed IOCONTROL malware to compromise IoT and OT systems, targeting critical infrastructure like gas stations. Meanwhile, the DroidBot banking malware infiltrates cryptocurrency and banking apps across Europe, leveraging MaaS operations for tailored attacks. Adding to the chaos, SpyLoan malware apps, with over eight million installs, exploited users in South America, Southeast Asia, and Africa, highlighting the escalating risks within app marketplaces. For detailed Cyber Threat Intel, click ‘Read More’.

Dec 4, 2024

Cyware Monthly Threat Intelligence, November 2024

The TSA reshaped the cybersecurity landscape for pipeline and railroad operators with proposed rules mandating incident reporting and risk management plans. Estimated to cost $2.1 billion over the next decade, the rules aimed to address growing cyber threats while balancing flexibility with resilience. Meta dismantled a sprawling web of over two million accounts tied to pig butchering scams in Southeast Asia and the UAE. Africa’s cybercrime ecosystem faced a decisive blow with Operation Serengeti, as over 1,000 suspects were arrested, and 134,000 malicious networks taken offline. TAG-110, a Russia-aligned threat group, launched a cyber-espionage campaign targeting governments and organizations in Asia and Europe. Using malware like HATVIBE and CHERRYSPY, it aimed to monitor geopolitical developments and assert influence. A botnet powered by Ngioweb malware converted 35,000 IoT devices into residential proxies. These compromised devices, found largely in the U.S., were sold on platforms like NSOCKS for malicious purposes. Water Barghest compromised over 20,000 IoT devices by exploiting known vulnerabilities. The group used Shodan to identify targets and deployed Ngioweb malware to connect them to its monetized network. LIMINAL PANDA, a Chinese cyberespionage group, has been targeting telecoms in South Asia and Africa since 2020. Using tools like SIGTRANslator and PingPong, the group exploits telecom protocols to steal critical data while staying undetected. NodeStealer has resurfaced, targeting Facebook Ads Manager accounts to steal credit card details and browser credentials. It uses Windows Restart Manager and Python scripts to execute its attacks, with stolen data sent via Telegram. BabbleLoader, a stealthy malware loader, delivers WhiteSnake and Meduza stealers. Disguised as accounting software, it targets English and Russian speakers, evading antivirus systems with advanced techniques.